@phnx-labs/agents-cli 1.22.112 → 1.22.114

package/dist/lib/permissions.d.ts

@@ -1,10 +1,8 @@
 import type { AgentId, PermissionSet, InstalledPermission, ClaudePermissions, CursorPermissions, OpenCodePermissions, CodexPermissions } from './types.js';
 import { CODEX_RULES_FILENAME } from './permissions-registry.js';
 export { CODEX_RULES_FILENAME };
-export type ParsedRules = PermissionSet;
-export declare const COMPUTER_PERMISSION_RULE_PREFIX = "Computer";
+type ParsedRules = PermissionSet;
 export declare const COMPUTER_APP_GATED_VERBS: readonly ["screenshot", "describe", "get-text", "launch", "raise", "click", "right-click", "type", "type-text", "key", "drag", "scroll", "ax-action", "focus", "wait"];
-export declare const COMPUTER_INPUT_GATED_VERBS: readonly ["raise", "click", "right-click", "type", "type-text", "key", "drag", "scroll", "ax-action", "focus"];
 export declare function formatComputerPermissionGrantHint(bundleId?: string): string;
 export declare function containsBroadGrants(rules: ParsedRules): {
     broad: string[];
@@ -33,7 +31,7 @@ export declare function discoverPermissionsFromRepo(repoPath: string): Array<{
 /**
  * Permission group info with rule count.
  */
-export interface PermissionGroupInfo {
+interface PermissionGroupInfo {
     name: string;
     ruleCount: number;
     path: string;
@@ -51,7 +49,7 @@ export declare function getTotalPermissionRuleCount(): number;
  * A permission preset recipe — names a preset and lists which groups it composes.
  * Lives at ~/.agents/permissions/presets/<name>.yaml.
  */
-export interface PermissionPresetRecipe {
+interface PermissionPresetRecipe {
     name: string;
     description?: string;
     includes: string[];
@@ -117,7 +115,7 @@ type CopilotToolApproval = {
     serverName: string;
     toolName: string | null;
 };
-export interface CopilotPermissionsConfig {
+interface CopilotPermissionsConfig {
     locations: Record<string, {
         tool_approvals?: CopilotToolApproval[];
         allowed_directories?: string[];
@@ -181,12 +179,12 @@ export declare function convertToGrokFormat(set: PermissionSet): {
         rules: GrokRule[];
     };
 };
-export type GrokRule = {
+type GrokRule = {
     action: 'allow' | 'deny';
     tool: string;
     pattern?: string;
 };
-export type KimiRule = {
+type KimiRule = {
     decision: 'allow' | 'deny';
     pattern: string;
 };
@@ -227,14 +225,6 @@ export declare function convertToOpenCodeFormat(set: PermissionSet): OpenCodePer
  * Codex config on sync, so the paths always match the box Codex runs on.
  */
 export declare function codexDefaultWritableRoots(home?: string, platform?: NodeJS.Platform): string[];
-/**
- * Merge Codex `[sandbox_workspace_write]` config, UNIONing `writable_roots` so a
- * baseline cache root never clobbers a root the user configured directly (a
- * plain object spread would overwrite the whole array), while merging scalar
- * keys (`network_access`) normally. Shared by the user- and version-scoped Codex
- * config writers so the two can't drift.
- */
-export declare function mergeCodexSandboxWrite(existing: Record<string, unknown> | undefined, incoming: NonNullable<CodexPermissions['sandbox_workspace_write']>): Record<string, unknown>;
 /**
  * Convert canonical permission set to Codex format.
  * Codex uses coarse-grained modes, so we infer the best fit.

package/dist/lib/permissions.js

@@ -23,7 +23,6 @@ import { updateGeminiSettings } from './gemini-settings.js';
 import { ANTIGRAVITY_ACTION_BY_TOOL, CANONICAL_TO_OPENCLAW_TOOL, CODEX_RULES_FILENAME, stripJsonComments, GROK_TOOL_BY_CANONICAL, PERMISSION_TARGETS, readCanonicalPermissions, } from './permissions-registry.js';
 export { CODEX_RULES_FILENAME };
 const HOME = os.homedir();
-export const COMPUTER_PERMISSION_RULE_PREFIX = 'Computer';
 export const COMPUTER_APP_GATED_VERBS = [
     'screenshot',
     'describe',
@@ -41,18 +40,6 @@ export const COMPUTER_APP_GATED_VERBS = [
     'focus',
     'wait',
 ];
-export const COMPUTER_INPUT_GATED_VERBS = [
-    'raise',
-    'click',
-    'right-click',
-    'type',
-    'type-text',
-    'key',
-    'drag',
-    'scroll',
-    'ax-action',
-    'focus',
-];
 export function formatComputerPermissionGrantHint(bundleId) {
     const target = bundleId && bundleId.length > 0 ? bundleId : '<bundle-id>';
     return `add Computer(${target}) to a permissions group, then \`agents computer reload\`\n` +
@@ -327,7 +314,7 @@ export function buildPermissionsFromGroups(groupNames) {
             // Split on CRLF or LF: git checks group yaml out with CRLF on Windows
             // (core.autocrlf), and a plain split('\n') leaves a trailing '\r' so the
             // closing-quote anchor `"$` never matches — extracting ZERO rules, which
-            // wrote an empty permission set and left `agents doctor --fix` unable to
+            // wrote an empty permission set and left `agents sync` unable to
             // reconcile permissions on Windows forever (PHNX-3187).
             const lines = content.split(/\r?\n/);
             let section = null;
@@ -952,7 +939,7 @@ export function codexDefaultWritableRoots(home = HOME, platform = process.platfo
  * keys (`network_access`) normally. Shared by the user- and version-scoped Codex
  * config writers so the two can't drift.
  */
-export function mergeCodexSandboxWrite(existing, incoming) {
+function mergeCodexSandboxWrite(existing, incoming) {
     const existingRoots = Array.isArray(existing?.writable_roots)
         ? existing.writable_roots
         : [];

package/dist/lib/picker.d.ts

@@ -14,7 +14,7 @@
  */
 import { Separator } from '@inquirer/core';
 /** Configuration for the interactive picker prompt. */
-export interface PickerConfig<T> {
+interface PickerConfig<T> {
     message: string;
     /** Optional dim hint line rendered directly under the header (above the rows). */
     subtitle?: string;
@@ -53,11 +53,11 @@ export interface PickerConfig<T> {
     linesAbovePrompt?: number;
 }
 /** The result returned when the user selects an item. */
-export interface PickedItem<T> {
+interface PickedItem<T> {
     item: T;
 }
 /** Configuration for the multi-select picker prompt. */
-export interface MultiPickerConfig<T> {
+interface MultiPickerConfig<T> {
     message: string;
     items: T[];
     filter: (query: string) => T[];
@@ -122,7 +122,7 @@ export declare function itemPicker<T>(config: PickerConfig<T>): Promise<PickedIt
  */
 export declare function multiItemPicker<T>(config: MultiPickerConfig<T>): Promise<T[] | null>;
 /** Configuration for the dynamic (async-refetch) picker prompt. */
-export interface DynamicPickerConfig<T, F, A = never> {
+interface DynamicPickerConfig<T, F, A = never> {
     message: string;
     /** The initial filter state. Changing it (via a keybinding) re-runs {@link load}. */
     initialFilter: F;
@@ -190,7 +190,7 @@ export declare function hotkeyToken(key: {
     meta?: boolean;
 }): string;
 /** The result returned when the user selects a row: the item plus the live filter. */
-export interface DynamicPicked<T, F, A = never> {
+interface DynamicPicked<T, F, A = never> {
     item: T;
     filter: F;
     action?: A;
@@ -206,3 +206,4 @@ export interface DynamicPicked<T, F, A = never> {
  * source and keymap are dynamic.
  */
 export declare function dynamicPicker<T, F, A = never>(config: DynamicPickerConfig<T, F, A>): Promise<DynamicPicked<T, F, A> | null>;
+export {};

package/dist/lib/placement.d.ts

@@ -15,7 +15,7 @@
  * Owner (who may fire / evaluate) is NOT placement — see monitors.
  */
 /** Where a job body executes. */
-export type PlacementKind = 'local' | 'device' | 'fleet' | 'cloud' | 'lease';
+type PlacementKind = 'local' | 'device' | 'fleet' | 'cloud' | 'lease';
 /**
  * Canonical placement object.
  *
@@ -33,7 +33,7 @@ export interface Placement {
     source: string;
 }
 /** Run-flag bag the placement parser understands. */
-export interface RunPlacementFlags {
+interface RunPlacementFlags {
     where?: string;
     host?: string;
     device?: string;
@@ -80,7 +80,4 @@ export declare function expandPlacementToRunFlags(placement: Placement): Pick<Ru
 export declare function placementFromHostStrategy(strategy: 'local' | 'host' | 'fleet' | 'cloud', host?: string): Placement;
 /** One-line human form for logs / help. */
 export declare function formatPlacement(p: Placement): string;
-/**
- * Short matrix for help footers and docs. Keep in sync with concepts.md.
- */
-export declare const PLACEMENT_MATRIX: string;
+export {};

package/dist/lib/placement.js

@@ -175,20 +175,3 @@ export function formatPlacement(p) {
         return `${p.kind}:${p.target}`;
     return p.kind;
 }
-/**
- * Short matrix for help footers and docs. Keep in sync with concepts.md.
- */
-export const PLACEMENT_MATRIX = `
-  Intent                         Flag / path
-  ─────────────────────────────  ──────────────────────────────────────────
-  This machine                   (default)  or  --where local
-  Named fleet box                --where device:<name>   (= --device)
-  Affinity pick (14d usage)      --where auto            (= --device auto)
-  Disposable cloud box           --where lease           (= --lease)
-  Reuse warm crabbox             --box <slug>
-  Vendor cloud task              --cloud   (= --where cloud[:provider])
-  Routines: body on one box      --run-on <name> / --placement host
-  Routines: pick any online      --placement fleet
-  Monitors: who evaluates        --device <owner>   (NOT body placement)
-  Monitors: where action runs    --run-on <host>
-`.trim();

package/dist/lib/platform/posixpath.d.ts

@@ -1,6 +1,6 @@
 /** The XDG user-bin dir, `~/.local/bin`. */
 export declare function localBinDir(home?: string): string;
-export interface SymlinkResult {
+interface SymlinkResult {
     /** A usable symlink to `target` exists at the path after this call. */
     ok: boolean;
     /** True only when this call created the symlink (false = already correct, or left untouched). */
@@ -26,3 +26,4 @@ export declare function ensureLocalBinSymlink(name: string, target: string, dir?
 export declare function loginShellResolves(cmd: string): boolean;
 /** Is `dir` on a fresh `bash -lc` PATH? Best-effort; a probe failure returns false. */
 export declare function dirOnLoginPath(dir: string): boolean;
+export {};

package/dist/lib/platform/winpath.d.ts

@@ -1,4 +1,4 @@
-export interface WinPathResult {
+interface WinPathResult {
     success: boolean;
     /** True when `dir` was already the first PATH entry (no write performed). */
     alreadyPresent?: boolean;
@@ -62,3 +62,4 @@ export declare function blocksLocalScripts(policy: string | null): boolean;
  * entry = `<prefix>/node_modules/@phnx-labs/agents-cli/dist/index.js` → `<prefix>`
  */
 export declare function npmGlobalBinFromEntry(entryJsPath: string): string;
+export {};

package/dist/lib/plugins/plugin-marketplace.d.ts

@@ -45,7 +45,7 @@ interface MarketplacePluginEntry {
         email?: string;
     };
 }
-export interface MarketplaceManifest {
+interface MarketplaceManifest {
     $schema?: string;
     name: string;
     description?: string;
@@ -115,7 +115,7 @@ export declare function copyPluginToMarketplace(plugin: DiscoveredPlugin, spec:
 export declare function validateClaudePluginManifest(manifest: unknown): string[];
 /**
  * The repairable fields present-and-invalid in a parsed manifest. Drives both
- * the dry-run preview (heal/doctor --fix) and the actual write below.
+ * the dry-run preview (heal/agents sync) and the actual write below.
  */
 export declare function repairableManifestFields(manifest: unknown): string[];
 /**

package/dist/lib/plugins/plugin-marketplace.js

@@ -275,7 +275,7 @@ function fieldHasBareEntries(value) {
 }
 /**
  * The repairable fields present-and-invalid in a parsed manifest. Drives both
- * the dry-run preview (heal/doctor --fix) and the actual write below.
+ * the dry-run preview (heal/agents sync) and the actual write below.
  */
 export function repairableManifestFields(manifest) {
     if (!manifest || typeof manifest !== 'object')

package/dist/lib/pr-land-detach.d.ts

@@ -2,7 +2,7 @@
  * Snapshot of the current branch's open PR (if any), for the headless-exit
  * fail-loud path. Returns null when there is no open PR or `gh` cannot answer.
  */
-export interface BranchOpenPr {
+interface BranchOpenPr {
     number: number;
     url: string;
     state: string;
@@ -30,3 +30,4 @@ export declare function getBranchOpenPr(cwd: string, execFileAsync: (file: strin
  * stderr warning. Never throws.
  */
 export declare function warnOrphanedOpenPr(cwd?: string): Promise<void>;
+export {};

package/dist/lib/profiles-presets.d.ts

@@ -34,7 +34,7 @@ export interface Preset {
     docPath?: string;
 }
 export declare const PRESETS: Preset[];
-export interface ResolvedPresetEnv {
+interface ResolvedPresetEnv {
     /** Env vars from preset.env — always set, no user input. */
     static: Record<string, string>;
     /** Vars the wizard needs to prompt for. */
@@ -48,3 +48,4 @@ export declare function getPreset(name: string): Preset | undefined;
 export declare function listPresets(): Preset[];
 /** Return the unique set of provider names across all presets. */
 export declare function listProviders(): string[];
+export {};

package/dist/lib/profiles.d.ts

@@ -88,8 +88,6 @@ export interface ProfileSummary {
     /** Native agent id or custom harness this one was forked from, if recorded. */
     forkedFrom: string | null;
 }
-/** Get the directory where profile YAML files are stored. */
-export declare function getProfilesDir(): string;
 /** Return the on-disk YAML path for a profile name. */
 export declare function getProfilePath(name: string): string;
 /** Validate a profile name against the allowed pattern. Throws on invalid input. */
@@ -158,7 +156,7 @@ export declare function baseUrlEnvKeyForHost(host: AgentId): string | null;
 /** Return the auth-token env var for a host, or null when unknown. */
 export declare function authEnvKeyForHost(host: AgentId): string | null;
 /** Options for {@link profileFromHostModel}. */
-export interface HostModelOptions {
+interface HostModelOptions {
     version?: string;
     /** Base URL for OpenAI/Anthropic-compatible hosts (claude, codex). Ignored for hosts without a known var. */
     baseUrl?: string;
@@ -225,7 +223,7 @@ export declare function renameProfile(oldName: string, newName: string): void;
  */
 export declare function resolveProfileEnv(profile: Profile): Record<string, string>;
 /** Resolved profile data ready for spawning an agent process. */
-export interface ResolvedProfileRun {
+interface ResolvedProfileRun {
     agent: AgentId;
     version?: string;
     env: Record<string, string>;
@@ -275,8 +273,4 @@ export interface ResolvedProfileRun {
  * collide the profile's harness identity with its host's catalog.
  */
 export declare function resolveProfileForRun(name: string, requestedModel?: string): ResolvedProfileRun;
-/**
- * Look up the preset a profile was created from, if any. Used by
- * `profiles view` to show upstream metadata like signup URLs.
- */
-export declare function getPresetForProfile(profile: Profile): Preset | undefined;
+export {};

package/dist/lib/profiles.js

@@ -12,14 +12,13 @@ import * as yaml from 'yaml';
 import { ALL_AGENT_IDS } from './agents.js';
 import { getUserAgentsDir } from './state.js';
 import { deleteKeychainTokenSync, getKeychainTokenSync, hasKeychainTokenSync, isSecretsClientError, isSecretsTransportError, profileKeychainItem, } from './secrets-client.js';
-import { getPreset } from './profiles-presets.js';
 import { MODEL_TIERS, isTierToken } from './model-tiers.js';
 import { addAccount, findAccount, resolveCredentialAccount } from './account-registry.js';
 import { atomicWriteFileSync } from './fs-atomic.js';
 import { listAccountProviders } from './account-provider-registry.js';
 const PROFILE_NAME_PATTERN = /^[a-z0-9][a-z0-9-_]{0,48}$/i;
 /** Get the directory where profile YAML files are stored. */
-export function getProfilesDir() {
+function getProfilesDir() {
     return path.join(getUserAgentsDir(), 'profiles');
 }
 function profilePath(name) {
@@ -640,10 +639,3 @@ export function resolveProfileForRun(name, requestedModel) {
     }
     return resolved;
 }
-/**
- * Look up the preset a profile was created from, if any. Used by
- * `profiles view` to show upstream metadata like signup URLs.
- */
-export function getPresetForProfile(profile) {
-    return profile.preset ? getPreset(profile.preset) : undefined;
-}

package/dist/lib/project-doctor.d.ts

@@ -17,7 +17,7 @@
  */
 import type { ProjectDef } from './projects.js';
 /** A definition that disagrees with the machine it describes. */
-export interface ProjectFinding {
+interface ProjectFinding {
     project: string;
     /** One line naming the disagreement, both sides quoted. */
     message: string;
@@ -34,3 +34,4 @@ export interface ProjectFinding {
  * - they disagree → a finding. This is the case that silently lies.
  */
 export declare function checkRepoSlug(def: ProjectDef, actualRemote: string | undefined): ProjectFinding | undefined;
+export {};

package/dist/lib/project-launch.d.ts

@@ -36,12 +36,12 @@
  */
 import type { AgentId } from './types.js';
 import { pluginInstallDir } from './plugins/plugin-marketplace.js';
-export interface LaunchSyncOptions {
+interface LaunchSyncOptions {
     agent: AgentId;
     version: string;
     cwd: string;
 }
-export interface LaunchSyncResult {
+interface LaunchSyncResult {
     /** Project rules were re-compiled into cwd/AGENTS.md (+ per-agent symlinks). */
     rulesCompiled: boolean;
     /** Number of workspace resource symlinks created or refreshed. */

package/dist/lib/project-probe.d.ts

@@ -13,7 +13,7 @@
  */
 import { type ProjectDef } from './projects.js';
 /** The on-disk state of one workspace repo on one machine. */
-export interface RepoWorkspaceStatus {
+interface RepoWorkspaceStatus {
     /** The probed path, echoed home-relative (re-roots per machine). */
     path: string;
     /** `.git` exists (a directory, or a FILE for a linked worktree). */
@@ -87,8 +87,8 @@ export declare function formatFleetWorkspaces(statuses: HostWorkspaceStatus[]):
  */
 export declare function formatFleetSummary(statuses: HostWorkspaceStatus[]): string;
 /** Severity for a workspace/repo warning on the project card. */
-export type WorkspaceWarningSeverity = 'critical' | 'continue';
-export interface WorkspaceWarning {
+type WorkspaceWarningSeverity = 'critical' | 'continue';
+interface WorkspaceWarning {
     severity: WorkspaceWarningSeverity;
     text: string;
     remediation?: string;
@@ -113,3 +113,4 @@ export interface WorkspaceWarning {
  * Caller decides whether the rows came from `--fleet` or a local probe.
  */
 export declare function workspaceWarnings(statuses: HostWorkspaceStatus[]): WorkspaceWarning[];
+export {};

package/dist/lib/project-pull.d.ts

@@ -37,7 +37,7 @@ export interface ProjectPullResult {
     message?: string;
 }
 /** The wire format this machine emits for the fleet fan-out. Fail-closed on parse. */
-export interface ProjectPullEnvelope {
+interface ProjectPullEnvelope {
     schemaVersion: 1;
     kind: 'project-pull';
     /** The emitting machine's {@link machineId} — verified by the caller. */
@@ -126,3 +126,4 @@ export declare function projectPullComplete(results: ProjectPullResult[]): boole
  * one the caller turns into a non-zero exit.
  */
 export declare function printProjectPullSummary(projectName: string, results: ProjectPullResult[], unavailableDevices: string[], unverifiedDevices?: string[]): void;
+export {};

package/dist/lib/project-resources.d.ts

@@ -1,9 +1,8 @@
 import type { AgentId } from './types.js';
-export interface ProjectResourceSyncResult {
+interface ProjectResourceSyncResult {
     synced: string[];
     skipped: string[];
 }
-export declare function projectAgentRoot(projectRoot: string, agent: AgentId): string;
 export declare function syncProjectResourcesToAgent(agent: AgentId, version: string, projectAgentsDir: string): ProjectResourceSyncResult;
 /**
  * Turn the manifest's managed paths (relative to agentRoot) into anchored,
@@ -52,3 +51,4 @@ export declare function detrackViaGitExclude(repoDir: string, relPath: string):
  * internal "user-owned". Returns null when nothing was skipped.
  */
 export declare function formatKeptProjectResources(skipped: string[]): string | null;
+export {};

package/dist/lib/project-resources.js

@@ -13,7 +13,7 @@ import { syncWorkflowToVersion } from './workflows-registry.js';
 const MANIFEST_FILE = '.agents-managed.json';
 const MANIFEST_VERSION = 1;
 const COPY_IGNORE = new Set(['.DS_Store', '.git', '.gitignore', '.venv', '__pycache__', 'node_modules']);
-export function projectAgentRoot(projectRoot, agent) {
+function projectAgentRoot(projectRoot, agent) {
     return path.join(projectRoot, agentConfigDirName(agent));
 }
 export function syncProjectResourcesToAgent(agent, version, projectAgentsDir) {

package/dist/lib/project-root.d.ts

@@ -81,12 +81,7 @@ export declare function setProjectRoot(rootPath: string): string;
  * home-relative string when under `$HOME`; undefined when `cwd` is not in a repo.
  */
 export declare function inferProjectRoot(cwd: string): Promise<string | undefined>;
-/**
- * Resolve the projects root, auto-inferring and caching on first use. Throws an
- * actionable error when it is neither configured nor inferrable from `cwd`.
- */
-export declare function ensureProjectRoot(cwd: string): Promise<string>;
-export interface ProjectRef {
+interface ProjectRef {
     slug: string;
     worktree?: string;
 }
@@ -126,3 +121,4 @@ export declare function resolveProjectDirs(ref: string, opts: {
     cwd: string;
     extraDirs: string[];
 }>;
+export {};

package/dist/lib/project-root.js

@@ -149,7 +149,7 @@ export async function inferProjectRoot(cwd) {
  * Resolve the projects root, auto-inferring and caching on first use. Throws an
  * actionable error when it is neither configured nor inferrable from `cwd`.
  */
-export async function ensureProjectRoot(cwd) {
+async function ensureProjectRoot(cwd) {
     const existing = getProjectRoot();
     if (existing)
         return existing;

package/dist/lib/project-schedule.d.ts

@@ -32,7 +32,7 @@ import type { LinearMilestone } from './linear-project-counts.js';
 /** How far ahead counts as "due soon" — one sprint's notice. */
 export declare const DUE_SOON_DAYS = 14;
 /** A verdict about the schedule, as a tagged union so `--json` stays stable. */
-export type ProjectVerdict = {
+type ProjectVerdict = {
     kind: 'declared';
     health: string;
 } | {
@@ -73,3 +73,4 @@ export declare function formatVerdict(v: ProjectVerdict): {
     text: string;
     warn: boolean;
 } | undefined;
+export {};

package/dist/lib/project-status.d.ts

@@ -69,7 +69,7 @@ export declare function rollupSessionsByProject(defs: ProjectDef[], sessions: Ac
  */
 export declare function isDeadStatus(status: string): boolean;
 /** Live vs finished sessions on a project. */
-export interface LiveDeadSplit {
+interface LiveDeadSplit {
     live: number;
     dead: number;
     /** Dead broken out by status, for the card's parenthetical. */
@@ -100,19 +100,6 @@ export declare function formatDeadSummary(split: LiveDeadSplit): string;
 export declare function sortProjectMembers(members: ProjectMember[]): ProjectMember[];
 /** Cap for the members line before it collapses to `+N more`. */
 export declare const MEMBERS_LINE_LIMIT = 6;
-/** Cap for host groups on the multi-line agents roster. */
-export declare const MEMBERS_HOST_LIMIT = 8;
-/**
- * Collapse members into distinct state cells (`agent · status · ticket[@host]`),
- * counting duplicates as `×N`. Pure.
- */
-export declare function collapseMemberCells(members: ProjectMember[], opts?: {
-    includeHostOnCell?: boolean;
-}): Array<{
-    cell: string;
-    n: number;
-    members: number;
-}>;
 /**
  * The `agents` line under `live`: one cell per DISTINCT member state —
  * `claude · running · RUSH-2107 @zion` — with identical cells collapsed to a
@@ -151,8 +138,6 @@ export interface ProjectWarning {
  * nudge (dirty tree, schedule not measurable).
  */
 export declare function warningEmoji(severity: ProjectWarningSeverity): string;
-/** Stable sort: critical first, then continue; stable within a tier. */
-export declare function sortProjectWarnings(warnings: ProjectWarning[]): ProjectWarning[];
 /**
  * Format one or more warning lines for the card footer. Pure (chalk only).
  * Returns empty when there is nothing to say.
@@ -190,3 +175,4 @@ export declare function enrichProjectSignals(def: ProjectDef, windowDays: number
     activityRoot?: string;
     skipRemote?: boolean;
 }): Promise<ProjectRemoteSignals>;
+export {};

package/dist/lib/project-status.js

@@ -171,12 +171,12 @@ export function sortProjectMembers(members) {
 /** Cap for the members line before it collapses to `+N more`. */
 export const MEMBERS_LINE_LIMIT = 6;
 /** Cap for host groups on the multi-line agents roster. */
-export const MEMBERS_HOST_LIMIT = 8;
+const MEMBERS_HOST_LIMIT = 8;
 /**
  * Collapse members into distinct state cells (`agent · status · ticket[@host]`),
  * counting duplicates as `×N`. Pure.
  */
-export function collapseMemberCells(members, opts = {}) {
+function collapseMemberCells(members, opts = {}) {
     const includeHost = opts.includeHostOnCell !== false;
     const counts = new Map();
     for (const m of sortProjectMembers(members)) {
@@ -282,7 +282,7 @@ export function warningEmoji(severity) {
     return severity === 'critical' ? '🔴' : '⚠️';
 }
 /** Stable sort: critical first, then continue; stable within a tier. */
-export function sortProjectWarnings(warnings) {
+function sortProjectWarnings(warnings) {
     const rank = { critical: 0, continue: 1 };
     return [...warnings].sort((a, b) => rank[a.severity] - rank[b.severity] || a.text.localeCompare(b.text));
 }

package/dist/lib/reconcile-and-repair.d.ts

@@ -21,7 +21,7 @@ import { type HealResult } from './heal.js';
 import { type SlotProjection } from './accounts/slots.js';
 import { type HookRuntimeRepairReport } from './hooks/install.js';
 import { type RemediateStaleInstallsResult, type FindAgentsCliInstallsOptions } from './self-update.js';
-export interface HookRewireResult {
+interface HookRewireResult {
     agent: AgentId;
     version: string;
     /** Hooks newly wired into settings.json by this pass. */
@@ -31,7 +31,7 @@ export interface HookRewireResult {
     /** Stable failure class; never expose a generated temporary shim pathname. */
     failure?: 'register-failed';
 }
-export interface RepairAfterSyncReport {
+interface RepairAfterSyncReport {
     heal: HealResult;
     hookRewire: HookRewireResult[];
     hookRuntimeRepair: HookRuntimeRepairReport;
@@ -51,14 +51,14 @@ export interface RepairAfterSyncReport {
  * hard-codes `/usr/local/lib/node_modules` et al. when `globalNodeModulesDirs` is
  * absent, so a purge is unsafe to run unscoped in a test — inject sandbox paths.
  */
-export interface PurgeInjection {
+interface PurgeInjection {
     runningRoot?: string;
     runningVersion?: string;
     pathEnv?: string;
     findOpts?: FindAgentsCliInstallsOptions;
     dryRun?: boolean;
 }
-export interface RepairAfterSyncOptions {
+interface RepairAfterSyncOptions {
     /** Scope the repair to one agent; omit for the umbrella sweep across all
      *  installed agents. (The purge is NOT tied to this — see `pruneClis`.) */
     agent?: AgentId;
@@ -115,3 +115,4 @@ export declare function repairAfterSyncJson(report: RepairAfterSyncReport): Reco
  * changed, so a clean sync stays quiet.
  */
 export declare function renderRepairAfterSync(report: RepairAfterSyncReport, log?: (s: string) => void): void;
+export {};

package/dist/lib/redact.d.ts

@@ -1,7 +1,13 @@
 /**
  * Shared redaction helpers for text that may be exported or logged.
  */
-/** Remove terminal control sequences from untrusted text before storage or display. */
+/**
+ * Remove terminal control sequences from untrusted text before storage or display.
+ *
+ * A single forward scan, not a regex: an OSC lookup for its terminator (BEL or
+ * ESC-\) is the classic polynomial-backtracking shape, and untrusted text can be
+ * built to trigger it. Each character is visited a bounded number of times here.
+ */
 export declare function sanitizeForTerminal(text: string): string;
 /**
  * Scrub secrets from `text`. Two passes: format-based patterns (above), then a